CVEs published in June 2026
865 tracked CVEs from 22 vendors had their first vendor advisory published in June 2026: 243 critical, 412 high, 13 in CISA KEV. Newest first.
930 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2026-10918Critical
Use after free in Viz
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10917High
Insufficient validation of untrusted input in Media
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10916Critical
Insufficient validation of untrusted input in DevTools
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10915High
Use after free in Core
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10914High
Use after free in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10913High
Use after free in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10912High
Insufficient validation of untrusted input in Extensions
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10911Critical
Insufficient validation of untrusted input in Media
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10910Critical
Type Confusion in V8
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10909High
Use after free in Dawn
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10908Critical
Use after free in FullScreen
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10907High
Out of bounds write in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10906High
Use after free in WebAuthentication
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10905Critical
Use after free in Network
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10904Critical
Inappropriate implementation in V8
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10903High
Use after free in WebRTC
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10902High
Use after free in Ozone
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10901Critical
Use after free in Passwords
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10900High
Use after free in Passwords
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10899High
Use after free in Ozone
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10898High
Stack buffer overflow in GPU
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10897Critical
Out of bounds write in GPU
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10896Critical
Use after free in Chrome for iOS
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10895High
Use after free in Ozone
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10894Critical
Use after free in Printing
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10893Critical
Use after free in Chromoting
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10892Critical
Out of bounds write in GPU
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10891High
Use after free in GFX
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10890High
Use after free in Cast
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10889High
Out of bounds read in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10888High
Use after free in Cast Streaming
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10887Critical
Use after free in Chromoting
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10886Critical
Use after free in FileSystem
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10885Critical
Use after free in Chrome for iOS
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10884High
Use after free in Chromecast
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10883High
Out of bounds write in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10882Critical
Use after free in Network
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-10881Critical
Out of bounds read and write in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-40965Critical
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure.
VMware · 1 advisory - Added
CVE-2026-40964High
Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations
VMware · 1 advisory - Added
CVE-2026-9614High
Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises)
Ivanti · 1 advisory - Added
CVE-2026-41013High
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release
VMware · 1 advisory - Added
CVE-2026-40990Medium
Spring Cloud: OOM error is possible while attempting to add infinite amount of functions to Function Registry.
VMware · 1 advisory - Added
CVE-2026-40989Medium
Spring Cloud: Under infinite recursion in the routing layer, request-handling can cause OOM error.
VMware · 1 advisory - Added
CVE-2026-47294High
Microsoft SharePoint Server Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2026-40861Unrated
Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler
Apache · 1 advisory - Added
CVE-2026-40961Unrated
Apache Airflow: Open Redirect Bypass Vulnerability
Apache · 1 advisory - Added
CVE-2026-40963Unrated
Apache Airflow: DAG authorization bypass on /ui/structure/structure_data
Apache · 1 advisory - Added
CVE-2026-41014Unrated
Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints
Apache · 1 advisory - Added
CVE-2026-49267Unrated
Apache Airflow: No certificate validation on SMTP STARTTLS connections
Apache · 1 advisory - Added
CVE-2026-41017Unrated
Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy
Apache · 1 advisory - Added
CVE-2026-41084Unrated
Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation
Apache · 1 advisory - Added
CVE-2026-42252Unrated
Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern
Apache · 1 advisory - Added
CVE-2026-42360Unrated
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking
Apache · 1 advisory - Added
CVE-2026-42358Unrated
Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets
Apache · 1 advisory - Added
CVE-2026-42359Unrated
Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
Apache · 1 advisory - Added
CVE-2026-45360Unrated
Apache Airflow: Arbitrary import in custom deadline-reference deserialization
Apache · 1 advisory - Added
CVE-2026-45426Unrated
Apache Airflow: Log server JWT authorization bypass via Python lstrip character stripping allows cross-Dag log access
Apache · 1 advisory - Added
CVE-2026-46764Unrated
Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
Apache · 1 advisory - Added
CVE-2026-48726Unrated
Apache Airflow: revoke_token unreachable in FabAuthManager / KeycloakAuthManager logout path
Apache · 1 advisory - Added
CVE-2026-49298Unrated
Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
Apache · 1 advisory - Added
CVE-2026-45505High
Arbitrary Code Execution via crafted discovery URI bypass
NetApp, Red Hat · 2 advisories - Added
CVE-2026-49157High
Unauthorized Broker Management via Incorrect Default Permissions
NetApp, Red Hat · 2 advisories - Added
CVE-2026-49270High
Information disclosure via unauthenticated BrokerInfo command
Apache, NetApp, Red Hat · 3 advisories - Added
CVE-2026-45192Unrated
Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response
Apache · 1 advisory